CVE-2026-90586

Name of the Vulnerable Software and Affected Versions Xtensa MMU userspace port (affected versions not specified)

Description An issue exists in the Xtensa MMU userspace port where the per-thread page-table pointer thread->arch.ptables is not initialized during thread setup. The function arch mem domain thread add() in arch/xtensa/core/ptables.c uses a non-NULL value of this field to determine if a thread is migrating from another memory domain. If the memory backing the struct k thread is not zeroed, the field contains stale data, causing the kernel to execute the migration branch and pass this value to reset region() as the base of a level-1 page table.

This condition can be triggered by an unprivileged user-mode thread on builds using CONFIG XTENSA MMU, CONFIG USERSPACE, and dynamically allocated kernel objects. Specifically, the k object alloc(K OBJ THREAD) system call allocates the thread object without zeroing it, and the k thread create() verifier accepts the object. An attacker can groom the heap by allocating and freeing other kernel objects to control the stale bytes.

Processing the invalid table in region map update() leads to an unguarded index into l2 page tables counter[]. Additionally, dup l2 table if needed() may copy from and write through the attacker-controlled level-1 base. This results in out-of-bounds reads and writes in supervisor mode, which can lead to kernel panics, kernel memory corruption, or a sandbox escape.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.